v3.23.2: the start-reset ordering fix (review follow-up)

A suite with start_reset and an incomplete SCP80 preset reset the card and
only then refused the start: the reset block ran before _test_preset_error.
The reset now runs after the preset checks - a run that cannot start must
not touch the card - and stays before the ADM gate, which must see the
post-reset card session (the reset bumps card_session, invalidating the ADM
latch).  The ICCID re-match stays with the reset block.

Test: an incomplete preset refuses with 400 and _card_reset_reinit is not
called.  846 frontend + 830 Python; sw cache simple-v415.

tests/test_fetch_routes.py

@@ -1702,6 +1702,21 @@ class TestScriptStoreHttpTests(unittest.TestCase):
             time.sleep(0.05)
         self.assertFalse(snap['running'], snap)
 
+    def test_a_bad_scp80_preset_refuses_before_the_reset(self):
+        # v3.23.2: the preset checks come first - a suite that cannot start
+        # must not reset the card
+        self.server.app = object()
+        suite = self._suite(name='reset me', start_reset=True)
+        self._post('/api/test/scripts', self._script(
+            suite_id=suite['id'],
+            steps=[{'type': 'action', 'kind': 'scp80',
+                    'params': {'apdu': '80E2900000'}}]))
+        with mock.patch.object(self.srv, '_card_reset_reinit') as r:
+            status, resp = self._post('/api/test/run', {'suite_id': suite['id']})
+        self.assertEqual(status, 400, resp)
+        self.assertIn('incomplete', resp['error'])
+        r.assert_not_called()
+
     def test_suite_start_reset_refuses_a_mismatched_iccid(self):
         self.server.app = object()
         suite = self._suite(name='reset me', start_reset=True)